OTP tokens are used to verify the identity of a user of, for example, an e-commerce site, banking site, or other site that requires verification. The verification operation works by taking password values from two separate but synchronized clocks, and comparing these values. In some instances, a clock may reside on a hand held device, while a second clock may reside on a third-party authentication server. This type of verification uses passwords based upon clocks or “Synchronized One-Time Passwords.” The hand held devices can include devices such as key fobs, Personal Digital Assistants (PDA), or cell phones. The time synchronized passwords are known as tokens, or OTP tokens.
OTP tokens are commonly used to verify the identity of the holder of the security token. For example, in the e-commerce context, the holder of an OTP token value may use this token to verify their identity, and once this identity is verified, the holder is able to purchase goods and services from the site. While OTP tokens are effective at verifying the identity of the token holder, they are not effective at verifying the identity of, for example, the site with which the token holder is transacting business. This type of verification is necessary in cases of, for example, phishing attacks and other types of e-commerce fraud. Phishers attempt to fraudulently acquire sensitive information, such as passwords and credit card details, by masquerading as a trustworthy person or business in an electronic communication. Phishing is typically carried out using email or an instant message.